Own the network: details, VPN, enterprise Wi-Fi, and a firewall that can also allow

Claude-Session: https://claude.ai/code/session_01Ms2FbjQy31TVf3CEvQhGM8

tests/quickshell/connectivity-contract

@@ -20,12 +20,126 @@ set -euo pipefail
 
 repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 harness="$repo_dir/config/dot/quickshell/connectivity-harness.qml"
+service="$repo_dir/config/dot/quickshell/services/Connectivity.qml"
+page="$repo_dir/config/dot/quickshell/modules/settings/ConnectivityPage.qml"
 
 fail() {
     printf 'connectivity contract: %s\n' "$1" >&2
     exit 1
 }
 
+# ── Connectivity stays native ────────────────────────────────────────────────
+#
+# This service reads NetworkManager and BlueZ through Quickshell's own bindings,
+# never by shelling out. That is not a style preference: a subprocess per read
+# turns a property binding into a fork on every repaint, and it loses the change
+# signals the whole page is built on -- the page would go back to polling and
+# would go stale between polls.
+#
+# When Connections grew a helper (`panama-network`, driven by NetworkTools), the
+# obvious shortcut was to let this service reach for it too. It must not. Every
+# nmcli invocation belongs on the far side of that helper; what stays here is
+# the native state and the wrappers over it.
+for path in "$service" "$page"; do
+    [[ -r "$path" ]] || fail "missing $path"
+done
+service_code="$(grep -vE '^\s*//' "$service")"
+! grep -qE '\bnmcli\b|\bProcess\b|execDetached|exec\(' <<<"$service_code" \
+    || fail 'Connectivity.qml shells out; NetworkManager reads here are native, and nmcli belongs in panama-network'
+
+# The page used to write NetworkManager state straight from a switch
+# (`Networking.wifiEnabled = value`, `adapter.enabled = value`), which put two
+# owners on one piece of state and left the service unable to react to its own
+# change. The wrappers exist so the page has exactly one way in.
+grep -q 'function setWifiEnabled' <<<"$service_code" \
+    || fail 'the service has no Wi-Fi wrapper, so the page has to write NetworkManager itself'
+grep -q 'function setBluetoothEnabled' <<<"$service_code" \
+    || fail 'the service has no Bluetooth wrapper, so the page has to write the adapter itself'
+
+page_code="$(grep -vE '^\s*//' "$page")"
+grep -q 'Connectivity.setWifiEnabled' <<<"$page_code" \
+    || fail 'the Wi-Fi switch does not go through the service'
+grep -q 'Connectivity.setBluetoothEnabled' <<<"$page_code" \
+    || fail 'the Bluetooth switch does not go through the service'
+! grep -qE 'Networking\.wifiEnabled\s*=' <<<"$page_code" \
+    || fail 'the page still writes Networking.wifiEnabled directly, bypassing the service'
+! grep -qE 'adapter\.enabled\s*=' <<<"$page_code" \
+    || fail 'the page still writes the Bluetooth adapter directly, bypassing the service'
+
+# The card that sent people to GNOME for Wi-Fi and networking is gone, and with
+# it the claim that Fedora owns this page. gnome-handoff-contract pins the rule;
+# this pins the specific rows, because they are what the card was made of.
+! grep -q 'Owned by Fedora' <<<"$page_code" \
+    || fail 'the "Owned by Fedora" card is back on a page that now manages the network itself'
+! grep -qE 'openGnomePanel\("(wifi|network)"' <<<"$page_code" \
+    || fail 'Connections still hands the user to GNOME for something it now does'
+
+# ── Every enum member the service names must exist ───────────────────────────
+#
+# This is the first bug in this file's header, generalized. `NetworkDeviceType
+# .Wifi` does not exist, so the lookup returned null and the page said "No Wi-Fi
+# adapter" on a machine whose Wi-Fi was connected. The same thing happened again
+# in securityLabel: `WifiSecurityType.Wep`, `.Wpa`, `.Wpa2`, `.Wpa3` and
+# `.Enterprise` are not members either -- the real ones are WpaPsk, Wpa2Psk,
+# Sae, StaticWep, WpaEap and so on -- so every switch arm compared against
+# `undefined`, nothing ever matched, and every secured network was labeled with
+# the fallthrough. Plausible names, no error, wrong answer.
+#
+# QML resolves an unknown enum member to undefined and says nothing, so no test
+# that runs the code can notice. This reads the member list out of the installed
+# Quickshell's own type description, so it stays true across upgrades rather
+# than becoming a second hand-kept list that can drift the same way.
+networking_types=""
+for candidate in /usr/lib64/qt6/qml/Quickshell/Networking/quickshell-network.qmltypes \
+                 /usr/lib/qt6/qml/Quickshell/Networking/quickshell-network.qmltypes; do
+    [[ -r "$candidate" ]] && { networking_types="$candidate"; break; }
+done
+if [[ -z "$networking_types" ]]; then
+    printf 'connectivity contract: NOTE (no Quickshell.Networking qmltypes found; enum members unchecked)\n'
+else
+    python3 - "$service" "$networking_types" <<'PY' || fail 'the service names enum members that do not exist, which QML resolves to undefined without complaining'
+import re
+import sys
+
+service_path, types_path = sys.argv[1:3]
+types_text = open(types_path, encoding="utf-8").read()
+
+# Each exported enum singleton: the name QML sees, and the members it has.
+enums = {}
+for block in re.findall(r"Component \{.*?\n    \}", types_text, re.S):
+    export = re.search(r'exports: \["Quickshell\.Networking/([A-Za-z0-9_]+) ', block)
+    values = re.search(r"values: \[(.*?)\]", block, re.S)
+    if export and values:
+        enums[export.group(1)] = set(re.findall(r'"([A-Za-z0-9_]+)"', values.group(1)))
+if not enums:
+    print(f"no enums could be read from {types_path}", file=sys.stderr)
+    raise SystemExit(1)
+
+source = "\n".join(line for line in open(service_path, encoding="utf-8")
+                   if not line.lstrip().startswith("//"))
+
+bad = []
+for enum_name, members in enums.items():
+    for member in set(re.findall(rf"\b{re.escape(enum_name)}\.([A-Za-z0-9_]+)\b", source)):
+        if member not in members:
+            bad.append(f"{enum_name}.{member} (real members: {', '.join(sorted(members))})")
+
+# A switch on a security type that names no member of the enum at all is the
+# same failure wearing a different hat, so the reference must be there too.
+if "securityLabel" in source and not re.search(r"\bWifiSecurityType\.", source):
+    bad.append("securityLabel decides security without naming a WifiSecurityType member")
+
+if bad:
+    print("\n".join(bad), file=sys.stderr)
+    raise SystemExit(1)
+PY
+fi
+
+if [[ "${PANAMA_CONNECTIVITY_STATIC_ONLY:-0}" == "1" ]]; then
+    printf 'connectivity contract: PASS (static)\n'
+    exit 0
+fi
+
 command -v nmcli >/dev/null || fail 'nmcli is needed to check the service against reality'
 
 run() { qs -p "$harness" "$@"; }